On the point: Fake Googlebot requests from distributed IP addresses bypass security mechanisms and cause higher bandwidth load, while the legitimate Googlebot undermines its own value through changed Google Search behavior.
Website administrators have recorded a wave of bot requests impersonating Googlebot since June. Attackers use this disguise to circumvent security mechanisms that typically exempt legitimate crawlers.
Website administrators register hundreds to thousands of bot requests daily that impersonate Googlebot. Chris Siebenmann, Unix systems administrator at the University of Toronto, documented these activities in June and described the increase as a large-scale campaign. The fake requests originate from IP address ranges of hosting and cloud providers such as HostRoyale, M247, Latitude.sh, Web2Objects, and AWS.
Attackers employ a targeted strategy: they send only a few requests per IP address and change the User-Agent string when blocked. This avoids immediate detection and circumvents security precautions that regularly exempt the legitimate Googlebot. The goal is to penetrate websites’ defense measures and gain access to content.
Google provides administrators with official verification methods: DNS queries via command-line tools and lists of authorized IP address ranges from the company. These resources are intended to protect against spoofing attempts.
The changed search engine behavior exacerbates the problem. Google increasingly displays AI-generated answers instead of direct links to websites, which calls into question the traditional purpose of crawling. Computer scientist Paul Cantrell outlined the underlying tension: the original social contract between Google and website operators was based on Google’s bots indexing content and generating visitor discovery – without commercializing the content itself. This mechanism no longer works when AI answers keep users away from the original website.
At the same time, automated bot traffic – both legitimate and illegitimate requests – strains infrastructure. Bot traffic now far exceeds human access on the internet and drives bandwidth costs up. Adding to this is the use of website data to train AI models without compensation or explicit permission. This development is causing some operators to reconsider their standards for Googlebot access.
Source: www.it-daily.net · Published July 2, 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 of the EU AI Act. Paraphrase and classification via Lumi News Pipeline v1.7.2.